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Abstract 



This paper considers three variants of quantum interactive proof systems in which short 
(meaning logarithmic-length) messages are exchanged between the prover and verifier. The 
first variant is one in which the verifier sends a short message to the prover, and the prover 
responds with an ordinary, or polynomial-length, message; the second variant is one in which 
any number of messages can be exchanged, but where the combined length of all the messages 
is logarithmic; and the third variant is one in which the verifier sends polynomially many 
random bits to the prover, who responds with a short quantum message. We prove that in 
all of these cases the short messages can be eliminated without changing the power of the 
model, so the first variant has the expressive power of QMA and the second and third variants 
have the expressive power of BQP. These facts are proved through the use of quantum state 
tomography, along with the finite quantum de Finetti theorem for the first variant. 

1 Introduction 

The interactive proof system model extends the notion of efficient proof verification to an inter- 
active setting, where a computationally unrestricted prover tries to convince a computationally 
bounded verifier that an input string satisfies a particular fixed property. They have been stud- 
ied extensively in computational complexity theory since their introduction roughly 25 years ago 
IIGMR851 IGMR891 IBab85l IBM88L and as a result much is known about them. (See IIAB09H and 
|Gol08L for instance, for further discussions of classical interactive proof systems.) 

Quantum interactive proof systems are a natural quantum computational extension of the in- 
teractive proof system model, where the prover and verifier can perform quantum computations 
and exchange quantum information. The expressive power of quantum interactive proofs is no 
different from classical interactive proofs: it holds that QIP = PSPACE = IP, and therefore any 
problem having a quantum interactive proof system also has a classical one |JJUW09| ILFKN921 



ISha92| . However, quantum interactive proof systems may be significantly more efficient than 
classical interactive proofs in terms of the number of messages they require, as every problem in 
PSPACE has a quantum interactive proof system requiring just three messages to be exchanged 
between a prover and verifier IIKWOOL This is not possible classically unless AM = PSPACE, and 
this equality implies the collapse of the polynomial-time hierarchy ||BM88llGS89L 

In this paper we consider quantum interactive proof systems in which some of the messages 
are short, by which we mean that the messages consist of a number of qubits that is logarithmic 
in the input length. Three particular variants of quantum interactive proofs with short messages 
are considered. The first variant is one in which the verifier sends a short message to the prover, 
and the prover responds with an ordinary, or polynomial-length, message. We prove that this 
model has the expressive power of QMA. The second variant is one in which any number of 
messages can be exchanged between the prover and verifier, but where the combined length of 
all the messages is logarithmic. We prove that this model has the expressive power of BQP. The 
third variant is one in which the verifier sends polynomially many random bits to the prover, who 
responds with a short quantum message. We prove that this model also has the expressive power 
of BQP. Thus, in each of these three cases, logarithmic-length messages are effectively worthless 
and can be removed without changing the power of the model. 

One possible application of our work is to the design of new quantum algorithms or QMA ver- 
ification procedures. Although we do not yet have interesting examples, we believe it is possible 
that an intuition about quantum interactive proof systems with short messages may lead to new 
problems being shown to be in BQP or QMA, based on characterizations of the sort we prove. 

Observe that all of these three results are immediate in the classical case. For example, one 
can enumerate all logarithmic-length interactions between a verifier and prover in polynomial- 
time, so our second model, assuming that the verifier is classical, has the expressive power of P 
(or BPP in the presence of randomness). This argument, however, does not work in the quantum 
case. To explain the difference let us consider the following simplification of this model. As- 
sume that instead of an arbitrary number of messages of logarithmic total length, there is only one 
logarithmic-size message allowed which is sent by the prover. This model is denoted by QMAj^g, 
and was known to be equal to BQP IIMW05L Here we present another proof for this fact to il- 
lustrate the main ideas of the paper. Upon receiving a logarithmic-size message from the prover, 
the verifier applies a binary measurement {Pacc/^rej} to decide whether to accept or reject. Thus 
the acceptance probability is at most the maximum eigenvalue of Pace- Although Pace acts on a 
logarithmic number of qubits, it is given by a polynomial-size circuit, so one cannot directly com- 
pute the matrix representation of Pace in polynomial-time. Nevertheless, using quantum process 
tomography we can perform the measurement {Pace, Pre]} ori polynomially many known states, 
and somehow by taking the average of their outcomes compute an approximation of Pace- Since 
the matrix representation of Pace has only polynomially many entries, this approximation can be 
arbitrarily tight. The next step is to simply find the maximum eigenvalue of this approximation. 

In this paper instead of applying quantum process tomography on a measurement, we per- 
form quantum state tomography on the normalized Choi-Jamiotkowski representation of the quan- 
tum channel corresponding to the measurement. These two approaches are equivalent, but the 
second one unifies the arguments in different sections. 

Besides quantum state tomography and Choi-Jamiolkowski representation of quantum chan- 
nels, finite quantum de Finetti theorem is another important tool in this work. Suppose that we 
are given some copies of a state and we want to verify that it is closed to some given state. Us- 
ing quantum state tomography on these copies we can find an approximation of the unknown 
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state and solve the problem. Assume now that we are not guaranteed that these copies are indeed 
copies of the same state; there can even be entanglement among different copies. To overcome 
these difficulties we use finite quantum de Finetti theorem to reduce the problem to the first case. 

The remainder of this paper has the following organization. Section |2] discusses some of the 
background information needed for the rest of the paper, including background on the Choi- 
Jamiolkowski representation of quantum channels, quantum state tomography, finite quantum de 
Finetti theorem, and quantum interactive proof systems. Sections HJIH and |5] then discuss the three 
variants of quantum interactive proof systems with short messages described above. 



2 Background 

We assume the reader is familiar with quantum information and computation, including the ba- 
sic quantum complexity classes BQP and QMA, simple properties of mixed states, measurements, 
channels, and so on ||KSV02irNC00L The purpose of the present section is to highlight background 
knowledge on three topics, represented by the three subsections below, that are particularly rele- 
vant to this paper. These topics are: the Choi-Jamiolkowski representation of quantum charmels, 
quantum state tomography, and quantum interactive proof systems. 

Before discussing these three topics, it is appropriate to mention a few simple points of notation 
and terminology. Throughout this paper we let E = {0,1} denote the binary alphabet, and for 
each A: G N we write C(Z*^) to denote the finite-dimensional Hilbert space whose standard basis 
vectors are indexed by S'^ (i.e., the Hilbert space associated with a /c-qubit quantum register). The 
Dirac notation is used to describe vectors in spaces of this sort. 

For a given space Q = C{TJ^), we write L (Q) to denote the space of all linear mappings from 
Q to itself, which is associated with the space of all complex matrices with rows and columns 
indexed by TJ^ in the usual way. The subsets of this space representing the positive semidefinite 
operators and density operators on Q are denoted Pos (Q) and D (Q), respectively. A standard 
inner product on L (Q) is defined as (X, Y) = Tr(X*y) for all X, Y G L (Q) (where X* denotes the 
adjoint, or conjugate-transpose, of X). The trace norm of an operator X G L (Q) is defined as 

||X||i = Tr VX*X, 

and the spectral (or operator) norm of X is denoted || X || . 



2.1 Quantum channels and the Choi-Jamiolkowski representation 

A quantum channel from a fc-qubit space Q — C(Z'^) to an /-qubit space 7?. = C(I,') is a completely 
positive and trace-preserving linear mapping of the form O : L (Q) — ?► L {TZ). (O is completely 
positive if <I>(g) Jl(5)/ foi" every Hilbert space S, is positive, meaning that it sends positive semidef- 
inite operators to positive semidefinite ones. Trance-preserving means that Tr(O(j0)) = Tr(jO).) 
We will write C (Q, TZ) to denote the set of all such quantum channels. For any quantum channel 
O G C{Q,TZ) one defines the (normalized) Choi-Jamiolkowski representation | Jam72 rCho75| of 
O as 

P = 4 E ^(|y>(z|)^|y)(2|. (1) 

In other words, this is the Z + k qubit state that results from applying O to one-half of k pairs of 
qubitsinthe |^+) = (|00) + 1 11) )/y2 state. 
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The action of the mapping O can be recovered from its normalized Choi-Jamiolkowski repre- 
sentation in the following way that makes use of post-selection. Suppose that Q and Qo are fc-qubit 
registers and R is an /-qubit register, that the pair (R, Qo) is initialized to the state p as defined by 
O in (dJ, and that Q is in an arbitrary quantum state (and is possibly entangled with additional 
registers not including Qo and R). Consider the following procedure: 

1. Measure each qubit of Q together with its corresponding qubit in Qo with respect to the Bell 
basis. 

2. If every one of these k measurements results in an outcome corresponding to the Bell state 
\(p^), then output "success," else output "failure." 

This procedure gives the outcome "success" with probability 4^*^, and conditioned on success 
the register R is precisely as it would be had it resulted from the channel <i> being applied to Q. (The 
registers Q and Qo can safely be discarded if the procedure succeeds.) To see this, assume first that 
the joint state of (R, Qo, Q) is p (X) ^ before the measurement takes place. Then the (unnormalized) 
state of R after the measurements are performed, assuming the end result is "success," is 

o(|y)(z|)(y'|y)(z|z')(y'iaz') = ^ E o(|y)(y|^|z)(z|) = lo(^). 

The probability of success is therefore 4^*^, and conditioned on this outcome the process imple- 
ments the channel O. In our applications k is logarithmic in the size of the problem, so O is 
implemented with an inverse polynomial probability which is enough for us. The fact that this 
process implements the channel ^ exactly for all density operators ^ implies that it also operates 
correctly in the case that Q is entangled with additional registers. 

2.2 Quantum state tomography 

Quantum state tomography is the process by which an approximate description of an unknown 
quantum state is obtained by measurements on many independent copies of the unknown state. 
To be more precise, let Q = C(E'^) denote the space corresponding to a /c-qubit register, and sup- 
pose that Xi, . . . , Xm are /c-qubit quantum registers independently prepared in an unknown /c-qubit 
state p G D (Q). The purpose of quantum state tomography is to obtain an explicit description of 
a A:-qubit state that closely approximates p. 

One way to perform quantum state tomography is through the use of an information-complete 
measurement. A measurement {¥„ : a G F} on fc-qubit registers is information-complete if and only 
if the set {Pa '. a El} spans the entire 4*^ -dimensional space L (Q). When such a measurement is 
performed on a A;-qubit state p, each measurement outcome is obtained with probability 

p(fl) = (P„,p) . 

Based on the assumption that {Pa '■ fl G T} is information-complete, this vector p of probabil- 
ities uniquely determines the state p. A close approximation of p, which may be obtained by 
sufficiently many independent measurements, leads to an approximate description of p. 

The accuracy of an approximation based on the process just described naturally depends on the 
choice of an information-complete measurement as well as the specific notion of approximation 
that is considered. Our interest will be on the trace distance || p — t7|| j between the approximation 
a and the true state p. To describe the "quality" of an information-complete measurement, it 
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is appropriate to describe the specific process that is used to reconstruct p from the vector of 
probabilities p. 

For any spanning set {P„ : fl G T} of L (Q), there exists a set {Ma : fl G F} C L (Q) that 
satisfies 

{Pa,X)=X 

for every X G L{Q). (One may find such a set {M^ : a G F} by solving a system of linear 
equations.) The set {Ma : fl G F} is uniquely determined when {P„ : fl G F} has exactly 4*^ 
elements (i.e., is a basis), and hereafter we will restrict our attention to this case. Notice that if p is 
a density matrix, the coefficients p{a) = {Pa,p) form a probability distribution. If q is a probability 
vector that represents an approximation to p, it holds that 



Y2p{a)Ma-Y^q{a)Ma 



< T2 \ W^aWi < \\p - q\\i max II Ma II 1. 



It is therefore desirable that the maximum trace norm over the set {Ma : fl G F} determined by 
the measurement {Pa : fl G F} is as small as possible. 

There is one additional consideration that is sometimes relevant, which is that the approxima- 
tion 

may fail to be positive semidefinite, and therefore fail to represent a valid quantum state. In this 
situation one can find a quantum state near to the approximation by renormalizing the positive 
part of the approximation. For the applications of tomography in this paper, however, this issue 
may safely be disregarded, as non-positive approximations of density operators will still provide 
valid approximations to the quantities we are interested in. 

An example of an information-complete measurement on a single qubit is given by the follow- 
ing matrices: 



' 2+V2 
8 
1-i 
^ 8 



'2+V2 -l-j- 




Pl 




\ 8 8 / 

This is not an optimal information-complete measurement, but it has the advantage of being sim- 
ple to describe and can be implemented exactly by a quantum circuit composed of Hadamard, 
controUed-not, and n/ 8-phase gates, and measurement in the standard basis. The corresponding 
set {Mo, Ml, M2, M3} described above is given by 



Mo = ' , ^ L M 




'1-V2 




M2 = ' , ^ , M3 



1^ -1 + /^ 
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It holds that ||M„||i = vTO < 4forfl G F = {0,1,2,3}. 

An information-complete measurement for k qubits may be obtained by taking tensor products 
of the above matrices. More specifically, for each x G F*^, let us define 2'*^ x 2*^ matrices Px and Mx 
as 

Px = Px, (S) ■ ■ ■ (S) Px, and Mx = M^j ^ ■ ■ • O Mx,. 

Then {Px : x e T''} is an information-complete measurement, and its corresponding set is given 
by {Mx : x G T''}. By the multiplicativity of the trace norm, it holds that || Mx\\^ = W''^^ < # for 
every k. 

Now, let us suppose that p is a quantum state on k qubits, and tomography (using the mea- 
surements just described) is performed on N copies of p. More precisely, the measurement {Px} is 
performed independently on each of the N copies of p, a probability distribution q -.l'^ ^ [0, 1] is 
taken to be the frequency distribution of the outcomes, and an approximation 

to p is computed. We require a bound on the accuracy of this approximation. Of course, nothing 
can be said in the worst case, as any sequence of measurement outcomes could occur with very 
small probability in general. 

Lemma 1. For any choice ofoO, taking N > 2^^'^ Iv' will guarantee that with probability at least 1 — e, 
the estimate H satisfies Hp — H||-^ < e. 

Proof. For any ^ > 0, and any fixed choice of x G T^, it follows from Hoeffding's inequality that 

Pr [\q{x) - p{x) I > < 2exp {-2NS^) . 
By the union boimd it follows that 



Pr 



q-p\\^>4!'S < Pr I q{x) - p{x) | > <5 for at least one x G F*" < 2^"+^ exp (-2^^) . 



Setting 5 = and using the inequality e * < l/a for all a > 0, we have 



Pr 

It follows that 



q-p\\^>£/^^ < 2^''+^exp (-2^'^+Ve) < e. 



2k+l / r^2k+l 



Pr[||p-H||^ > e] < Pr[||(?- pII-^ > £/4*-'] < e. 

□ 

The notion of quantum process tomography has also been considered, where a quantum mea- 
surement or charmel is approximated through many independent evaluations of an appropriate 
sort (see for example IINCOO|l ). In this paper, however, it is not necessary to consider this sort 
of tomography as being any different from state tomography. Specifically, we will approximate 
channels (and measurements, modeled as channels) by evaluating them on maximally entangled 
states, followed by ordinary quantum state tomography on the normalized Choi-Jamiolkowski 
representations that result. 
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2.3 Finite quantum de Finetti theorem 



Suppose that Qi, . . . , Qn are all fc-qubit registers. A state on (Qi, . . . , Qjv) is called symmetric if it is 
invariant under any permutation of its registers. For instance, any product state of the form p'^^ 
is symmetric. Any convex combination of such states is symmetric as well. Note, however, that 
there are symmetric states that cannot be written as a convex combination of symmetric product 
states as above; as an example consider the following state 



|x). 



Nevertheless, by tracing out any subsystem of \xp) the resulting reduce density matrix is in the 
convex hall of symmetric product states. The following theorem generalizes this observation. 



Theorem 2. (Finite quantum de Finetti theorem ^KR05\ \CKMR07^ ) Suppose that pjv+o! is a symmetric 
state over registers (Qi, . . . , Qn+„,), and let = TrQj^^^...Q^^^{pj^^m)- Then there exist states and 
probability vector pj such that 



0N 



< 



N + m' 



2.4 Quantum interactive proofs 

Quantum interactive proof systems are a natural quantum analogue of ordinary, classical inter- 
active proof systems, where the prover and verifier may process and exchange quantum infor- 
mation. We will only consider quantum interactive proof systems having an even number of 
messages in this paper, so for simplicity we will restrict our discussion to this case. 

For t being a function of the form f : N — > N, we define a f-round (or (2i) -message) quantum 
verifier y to be a collection of quantum circuits 

y = {y,,y : xGE*, 0<;<f(|x|)}, 

which can be generated in polynomial-time given x and /. We will generally write t rather than 
hereafter in this paper, keeping in mind that t might vary with the input length. We as- 
sume that the verifier's circuits are composed of standard unitary quantum gates (controUed-not, 
Hadamard, and 7r/8-phase gates, let us say), as well as ancillary and erasure gates. Included 
in the description of these circuits is a specification of which input and output qubits are to be 
considered private memory qubits and which are considered message qubits. The message qubits 
refer to qubits that are sent to or received from a prover (to be described shortly). The following 
properties are required of the circuits describing a verifier: 

1. For each x, the circuit V^fl takes no input qubits, and the circuit V^^t produces a single output 
qubit (called the acceptance qubit). 

2. There exist functions Vi,V2,--- such that Vx,]-! outputs (| x | ) private memory qubits and Vy^^j 
inputs tiyd X I ) private memory qubits for 1 < < f. 

3. There exist functions qi,q2, . . . and ri,r2, . . . that specify the number of message qubits the 
verifier sends to or receives from the prover on each round, for a given input length. More 
precisely, each circuit Vx,y_i outputs i?;(|x|) message qubits and each circuit V^^j inputs 
message qubits, for 1 < ; < t. 
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Figure 1: An illustration of an interaction between a prover and verifier in a quantum interactive 
proof system. In the picture it is assumed that t = 3. The labels Vj, pj, qj and rj on the arrows refer 
to the number of qubits represented by each arrow. 

Similar to the function t, we will often omit the argument | x | from the functions Vj, qj, and ry for 
the sake of readability. When it is convenient, we will refer to the message qubits sent from the 
verifier to the prover as question qubits and qubits sent from the prover to the verifier as response 
qubits. 

A f-round (or (2i)-message) prover is defined in a similar way to a f-round verifier, but no 
computational restrictions are made. Specifically, a f-round prover is a collection of quantum 
channels 

P^{Px,j : xeZ*, l<;<f(|x|)}. 

Again, the input and output qubits of these channels are specified as private memory qubits or 
message qubits. When a particular prover P is considered to interact with a given verifier V, one 
naturally assumes that they agree on the number of messages and the number of qubits sent in 
each message, as suggested by Figure [H But given the verifier there is no restriction on pj, the 
number of private memory qubits used by the prover at the j-th round. Although pj could in 
principle be unbounded, it is not difficult to show that for any choice of verifier and prover there 
is another prover that simulates the same interaction and uses at most a polynomial number of 
private memory qubits (see iGW07|| ). 

Now, on a given input string x, the prover P and verifier V have an interaction by composing 
their circuits /channels as described in Figure [H The maximum acceptance probability for a given 
verifier V on an input x refers to the maximum probability for the circuit V^^t to output 1, assuming 
it is measured in the standard basis, over all choices of a compatible prover P. It is always the case 
that a maximal probability is achieved by some prover. 

Classes of promise problems may be defined by quantum interactive proof systems in a variety 
of ways. We will delay the definitions of the classes we consider to the individual sections in which 
they are discussed. 

3 Two-message quantum interactive proofs with short questions 

The first specific variant of quantum interactive proof systems we consider are those in which 
just a single round of communication takes place, with the first message being short (at most 
logarithmic-length) and the second message being normal (at most polynomial-length). In par- 
ticular, let us say that a 1-round verifier y is a [log, poly] quantum verifier if the number q = qi 
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of question qubits it sends during the first and only round of communication satisfies q{n) = 
0(log n). For functions of the form fl, : N — > [0, 1] we define QIP( [log, poly], a, b) to be the class 
of all promise problems B = (Byes, ^no) for which there exists a [log, poly] quantum verifier V with 
completeness and soundness probability bounds a and b, respectively. In other words, V satisfies 
the following properties: 

1. For every string x S Byes, there exists a prover P compatible with V that causes V to accept x 
with probability at least fl ( | x | ) . 

2. For every string x G B^o, and every prover P compatible with V, it holds that P causes V to 
accept X with probability at most ( | x | ) . 

For a wide range of choices of a and b, these classes coincide with QMA as the following theorem 
states. 

Theorem 3. Let a, : N ^ (0/1) be polynomial-time computable functions such that a{n) — b{n) > 
1/ p{n) for some polynomial p. Then QIP( [log, poly], fl, b) = QMA. 

Proof. It is clear that QMA C QIP( [log, poly], fl, b) for any choice of a and b that satisfy the condi- 
tions of the theorem, so our goal is to prove the reverse containment. 

Let B = (Byes, Bno) be a promise problem in QIP( [log, poly], fl, b), and let y be a [log, poly] 
verifier that witnesses this fact. We write q (as above) to denote the number of question qubits 
the verifier V sends, and write r to denote the number of response qubits V receives. As V is a 
[log, poly] verifier it holds that q{n) = O(logn). For a fixed input x, we will write Q = C(Z'') to 
denote the question space and TZ = C(E'') to denote the response space for V, corresponding to the 
question and response qubits in the obvious way. 

Our goal is to prove that B G QMA, and to do this we will define a verification procedure (to 
be referred to as Arthur) that demonstrates this fact. Suppose P is a prover that interacts with V. 
For a fixed input string x, the action of P may be identified with a quantum channel O G C{Q,Tl), 
and any such charmel defines a quantum state p G D [TZ(E> Q) according to its normalized Choi- 
Jamiolkowski representation (d). We will define Arthur so that he expects to receive many inde- 
pendent copies of this state. He will check its validity using quantum state tomography, and will 
use the state to apply the mapping O himself through post-selection. 

More specifically, we define Arthur so that he performs the following actions: 

1. Input N + m registers (Ri, Qi), . . . , (Rw+m/ Qw+m)/ where N and m are polynomials in the input 
length n to be specified below. 

2. Randomly permute the pairs (Ri, Qi), . . . , (Rw+m/ Qn+iu), according to a uniformly chosen per- 
mutation 71 G S]v+m/ and discard all but the first N + 1 pairs. 

3. Perform quantum state tomography on the registers (Q2, . . . , Qn+i)/ and reject if the resulting 
approximation is not within trace-distance 5 lloi the completely mixed state 1/2'', for 5 to be 
specified below. 

4. Simulate the original protocol (P, V) by post-selection using the register pair (Ri, Qi). Reject 
if the post-selection fails, and otherwise accept or reject as the outcome of the proof system 
dictates. 

To specify N, m and S, we first set 

1 
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for p being the polynomial whose reciprocal separates the completeness and soundness probabil- 
ity bounds a and b. Now set 



S 




N = 



and 



2N4'? 



(.5/2)3 



m = 



e 



Given that q is logarithmic, it holds that N,m,l/ e and 1/5 are polynomially bounded. 

Suppose first that x G Byes, which implies that there exists a prover P that causes V to accept 
X with probability at least a. Let O denote the quantum channel that describes the behavior of P, 
and let p be the normalized Choi-Jamiolkowski representation of O as described in ([T]|. Then for 
each of the register pairs (Ry, Qy) being prepared independently in the state p, it holds that Arthur 
rejects in step 3 with probability at most 5/2 (Lemma [T), and accepts in step 4 with probability at 
least (conditioned on not having rejected in step 3). Arthur therefore accepts with probability 
at least 



Now let us suppose that x G Bno- We first consider the situation in which the state of the 
registers (Qi, . . . , Qn+i) at the beginning of step 3 has the form 



for some density operator ^ G D ( Q) . There are two cases to consider: one is that ||^ — 1/2''||^ < 5 
and the other is that || ^ - 1/2"? || ^ > 5. If it is the case that || ^ - 1/2'? || ^ < 5, then by the Fuchs- 
van de Graaf inequalities ||FvdG99l there must exist a state p G D (7?. (g) Q) satisfying Tr-ji^p) = 
\/73 that is within trace distance e of the state of (Ri, Qi). To be more precise, consider a fixed 
purification \ ^) oi the state of (Ri, Qi) with an auxiliary register E. Since ^ = Tr-z^jg^dt/;) (t/;|) has a 
high fidelity with 1/2'', and due to the characterization of fidelity in terms of purifications, there 
exists a purification of 1 / 2'? over ( R, Q, E ) that has a large overlap with 1 1/^ ) . Then p can be chosen 
as the reduce density matrix of this pure state over (R, Q). Now given that x G Bno/ the state p 
would cause acceptance in step 4 with probability at most b/4'', and therefore acceptance may 
occur in the case at hand with probability at most fc/4'? + £. If, on the other hand, it holds that 
II ^ — 1/2'' 11^ > ^, then rejection must occur in step 3 with probability at least 1 — (5/2, so Arthur 
accepts with probability at most 5/2. (which of course is smaller than b/4'' + z). Thus, in both cases, 
acceptance occurs with probability at most fc/4'' + £. It follows that if the registers (Qi, . . . , Qn+i) 
are, at the beginning of step 3, in any state of the form 



(i.e., a convex combination of states of the form just discussed), acceptance may occur with prob- 
ability at most fo/4'' + £. Finally, by the finite quantum de Finetti theorem (Theorem |2]) it holds 
that the state of (Qi, . . . , Qn+i) after step 2, is within trace-distance e of a state of the form (|2]), and 
therefore the probability of acceptance is at most fc/4'' + 2e in the general case. 

Given that fl/4'' — £ and fc/4'' + 2£ are efficiently computable and separated by the reciprocal 
of a polynomial, it holds that B is in QMA as claimed. □ 




r®(N+l) 
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Figure 2: Illustration of a quantum interactive proof in which the messages are single bits. 



4 Quantum interactive proofs with only short messages 

Next we consider quantum interactive proof systems restricted so that the total number of qubits 
exchanged by the prover and verifier is logarithmic. We prove that any problem having such a 
quantum interactive proof system is contained in BQP. This fact represents a significant general- 
ization of the equality QMAj^g = BQP proved in IIMW05L Like the result of the previous section, 
our proof of this fact is based on quantum state tomography. In addition we will make use of the 
quantum games framework of IIGW07II . 

It is clear that any quantum interactive proof system allowing at most a logarithmic num- 
ber of qubits to be exchanged can be simulated by one in which a logarithmic number of single 
qubit messages are permitted, because any number of these messages could consist of meaning- 
less "dummy" qubits that are interspersed with the qubits sent by the other party. To be more 
precise, let t{n) = O(logn) and consider a f-round quantum interactive proof system in which 
each message consists of a single qubit (i.e., qi = ri = ■ ■ ■ = qt = rt = 1). We will write 
QIPlog(fl, b) to denote the class of problems having quantum interactive proof systems of this sort 
having completeness and soundness probability bounds a and b, respectively. As the following 
theorem states, this model offers no computational advantage over BQP. 

Theorem 4. Let fl, : N ^ (0/1) polynomial-time computable functions such that a{n) — bin) > 
1/ p{n) for some polynomial p. Then QIPiog(fl, b) = BQP. 

Proof. It is clear that BQP C QIPjQg(fl, b), and so it remains to prove the reverse containment. To 
this end let B = (Byes/ Bno) be a promise problem in QIPiog(fl, b), and let y be a verifier that wit- 
nesses this fact. As above, let ^(n) = 0(log n) denote the number of rounds of commimication this 
verifier exchanges with any compatible prover. For a fixed input string x, we will write Qi, . . . ,Qt 
to denote copies of the Hilbert spaces C(E) associated with the t single-qubit messages that V 
sends to a given prover P, and we will write TZi, . . . ,TZt to denote copies of the same space C(E) 
corresponding to the response qubits of P. 

The action of V, on a given input string x, is determined by t + 1 quantum circuits Vxfi, . . . , f 
as defined in Section |2l Figure |2] illustrates an interaction between V and a prover P for the case 
that t = 4i. Now consider the channel O obtained from the circuits Vx^, . . . , Vx^t by setting all 
of the response qubits the verifier receives from the prover as input qubits and setting all of the 
question qubits sent by the verifier to the prover as output qubits. More precisely, O maps states 
on the space TZi (Si ■ ■ ■ TZt to states on the space A (Si Qi (Si ■ ■ ■ (Si Qt, where A denotes the single- 
qubit space associated with the acceptance qubit. Figure |3] illustrates this channel for the protocol 
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pictured in Figure |2l 
Next, let 

p = ^ E ^(ly)(z|)^ly)(z| 

be the normalized Choi-Jamiolkowski representation of <t>. The state p is obviously efficiently 
preparable given a description of V. By independently preparing N = 2^^^^'^^^ / copies of p, for 
e > to be specified later, and performing quantum state tomography, one obtains a Hermitian 
operator H on A (Si TZi <Si ■■■ <Si TZt Qi ■■■ Qt that satisfies |j H — p || ^ < e with probability at 
least 1 — £. Let us also define 

= 0l)p(|l) ^1) and Hi = ((1| ®1)H(|1) ®1) 

to denote the projection of these operators on the subspace in which the qubit ^ is 1 1 ) (corre- 
sponding to accept). 

Using the terminology of IIGW07L pi is a co-strategy which describes the verifier's action, and 
the prover optimizes the acceptance probability corresponding to pi over all strategies. (Strategies 
are defined similar to co-strategies as above but with respcet to the prover 's action.) Given any 
strategy X of the prover, the acceptance probability is proportional to the inner product of pi and 
X. More precisely, the maximum acceptance probability is equal to 

maximize: 2^ {pi, X) 
subject to: X ^ St 

where St C Pos {TZi ® ■ ■ ■ ^ TZt (Si Qi S ■ ■ ■ ® Qt) is the space of all strategies. It is shown in |GW07[ 
that St is characterizes as 5o = 1 and 

5^' = {x > : TrTi.{X) = Y (S Iq^, Y G 

for / > 1. This characterization of St turns the above optimization problem to a semidefinite 
program. So we just need to replace pi with its approximation Hi. 
It is clear that Tr(X) = 2^ for every X G St, and therefore 

|2' (pi,X) -2' (Hi,X)| <2f ||X|j llpi-Hilli <4'|1pi-Hi||i <4'||p-H||i 
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for every X G 5f. By taking 

1 

for instance, one may therefore distinguish the cases x G Byes and x G Bno with probability 1 — e, 
by solving the semidefinite program described above. (Semidefinite programs can be efficiently 
solved up to an inverse polynomial accuracy.) □ 

We note that precisely the same argument allows one to conclude that quantum refereed games, 
as defined in IIGW07I , allowing for at most a logarithmic number of qubits of communication 
offer no computational power beyond BQP. In other words, QRGjog = BQP, for QRCj^g defined 
appropriately. The details are left to the reader. 



5 Two-message quantum interactive proofs with short answers 

In light of the results of Section |3l one may ask if two-message quantum interactive proofs with 
short answers (as opposed to short questions) have the power of QMA or even BQP. If this is true 
it is likely to be difficult to show: the graph non-isomorphism problem, which is not known to be 
in QMA, has a simple and well-known classical protocol IIGMW91II requiring polynomial-length 
questions and constant-length answers. (Indeed, every problem in QSZK has a two-message 
quantum interactive proof system with a constant-length message from the prover to the verifier, 
for any choice of constant completeness and soundness errors IIWat02L ) 

We can show, however, that public-coin quantum interactive proofs in which the verifier sends 
polynomially many random bits to the prover, followed by a logarithmic-length quantum message 
response from the prover, have only the power of BQP. 

Following a similar terminology to the classical case, we refer to a quantum interactive proof 
system in which the verifier's messages to the prover consist of uniformly-generated random bits 
as quantum Arthur-Merlin games. Let us write QAM( [poly, log], a, b) to denote the class of promise 
problems having two-message quantum Arthur-Merlin games with completeness and soundness 
probability bounds a and b, in which Merlin's response to Arthur has logarithmic length. 

Theorem 5. Let a,b : IN ^ (0/1) polynomial-time computable functions such that a{n) — b{n) > 
l/p{n) for some polynomial-bounded function p. Then QAM( [poly, log], fl,b) = BQP. 

Proof. Assume that B is a promise problem in QAM([poly, log],fl, b), and consider a choice of 
Arthur that witnesses this fact. For r(n) = 0(log n), and for any choice of an input string x, Arthur 
chooses a random string y with length polynomial in | x |, and then measures r = r{\x\) qubits sent 
by Merlin with respect to some binary-valued measurement {Pq^, P^'^} that depends on x and y. 
Thus, assuming that the randomly chosen string is y, the maximum acceptance probability of 
Arthur is equal to the spectral norm of P^'^. So to find P^'^ (and its norm) we perform quantum 
state tomography on the normalized Choi-Jamiolkowski representation of the channel 

^,,y{a) = {P',y,a)\0){0\ + {P','\a)\l){l\, 

which describes Arthur's measurement. 

The following algorithm shows that B G BQP. 

1. Choose y uniformly at random (just as Arthur does). 



13 



2. Let 

£ = ^ , o and N = 5 — . 

2r+3p £3 

Prepare N copies of the state p, defined to be the normalized Choi-Jamiolkowski representa- 
tion of ^x,y, and perform quantum state tomography of p. Let H denote the result. Then by 
Lemma [1] with probability at least 1 — £, Hp — H||^<£. 

3. Compute the value 

ay = 2'1((1|^1)H(|1)^1)||. 
It can easily be shown that Uy is an approximation of 1 1 P^'^ 1 1 . If > 1 then accept. Otherwise, 



accept with probability ocy and reject otherwise. 



Since the maximum acceptance probability of Arthur is equal to the expectation value of 1 1 
over the random choice of y, and with probability 1 — £, is within distance 2''£ of 1 1 ^'i^''" 1 1 / the 
above procedure has acceptance probability within 1/ (4p) of the maximum acceptance probabil- 
ity of Arthur. Therefore B e BQP. □ 



6 Open problems 

Besides the open problems mentioned above, the following two questions have been raised by 
unknown referees which we leave for future works. The first one is to find the expressive power 
of the following model: the verifier and prover send messages to each other with the total number 
of 0(log n) qubits and at the end the prover sends a polynomial-size message to the verifier. This 
model contains QMA and it seems that combining the ideas in Sections |3] and |4] the other direction 
can also be proved. The other model is an interactive protocol in which the verifier always sends 
public-coin messages to the prover of the total polynomial-length and the prover replies with 
qubits of the total logarithmic-length. 
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